Microsoft Teams IDOR Vulnerability – 25 June 2023

Microsoft Teams’ default configuration allows users from outside (external tenants) of their organization to reach out to their staff members.

The application doesn’t allow external tenants from sending files. However, security researchers discovered an Insecure Direct Object References “IDOR” vulnerability that allows external tenants to bypass security controls and send malware to internal staff members.

The security bypass is achieved by sending a POST request to “/v1/users/ME/conversations/<RECIPIENT_ID>/messages” and switching the internal and external (target employee) recipient IDs.

Threat actors can easily buy a domain similar to a target organization’s and register it with Microsoft 365, thus setting up a legitimate Teams tenancy and not having to build complex phishing infrastructure.

It should be highlighted that when this vulnerability is combined with social engineering via Teams it becomes very easy to start a back-and-forth conversation, jump on a call, share screens, and more.

The threat actors abused this technique to deliver the C2 malware payload directly into the target inbox to gain the initial foothold.

The researchers say this bug provides a “potentially lucrative avenue” for threat actors because of how straightforward, simple and reliable it is for them to deliver malware to organizations without the need to craft socially-engineered email messages with malicious links or files.